Cisco Firepower 1010 Manual de usuario

Getting Started

The following topics explain how to get started configuring the Firepower Threat Defense (FTD) .

•Is This Guide for You?, on page 1

•New Features in FDM/FTD Version 7.1.0, on page 2

•Logging Into the System, on page 7

•Setting Up the System, on page 11

•Configuration Basics, on page 32

Is This Guide for You?

This guide explains how to configure Firepower Threat Defense using the Firepower Device Manager (FDM)

web-based configuration interface included on the Firepower Threat Defense devices.

The FDM lets you configure the basic features of the software that are most commonly used for small or

mid-size networks. It is especially designed for networks that include a single device or just a few, where you

do not want to use a high-powered multiple-device manager to control a large network containing many

Firepower Threat Defense devices.

If you are managing large numbers of devices, or if you want to use the more complex features and

configurations that Firepower Threat Defense allows, use the Firepower Management Center (FMC) to

configure your devices instead of the integrated FDM.

You can use the FDM on the following devices.

Table 1: FDM Supported Models

Minimum FTD Software VersionDevice Model

6.4Firepower 1010, 1120, 1140

6.5Firepower 1150

6.2.1Firepower 2110, 2120, 2130, 2140

7.1Secure Firewall 3110, 3120, 3130, 3140

6.5Firepower 4110, 4115, 4120, 4125, 4140, 4145, 4150

6.6Firepower 4112

Getting Started

Minimum FTD Software VersionDevice Model

6.5Firepower 9300

6.2.2FTDv (FTDv)for VMware

6.2.3FTDv for Kernel-based Virtual Machine (KVM) hypervisor

6.5FTDv for the Microsoft Azure Cloud

6.6FTDv for the Amazon Web Services (AWS) Cloud

6.1ASA 5508-X, 5516-X

Support for these models ends with 7.0 being the last

allowed version. You cannot install version 7.1 or later on

these models.

Note

6.2.3ISA 3000 (Cisco 3000 Series Industrial Security Appliances)

New Features in FDM/FTD Version 7.1.0

Released: December 1, 2021

The following table lists the new features available in Firepower Threat Defense 7.1.0 when configured using

FDM.

DescriptionFeature

Platform Features

We introduced the Secure Firewall 3110, 3120, 3130, and 3140.

You can hot swap a network module of the same type while the firewall

is powered up without having to reboot; making other module changes

requires a reboot. Secure Firewall 3100 25 Gbps interfaces support

Forward Error Correction as well as speed detection based on the SFP

installed. The SSDs are self-encrypting drives (SEDs), and if you have

2 SSDs, they form a software RAID.

Note that the Version 7.1 device manager does not include online help

for these devices. See the documentation posted on Cisco.com.

New/Modified screens: Device >Interfaces

New/Modified Firepower Threat Defense commands: configurenetwork

speed, configure raid, show raid, show ssd

Secure Firewall 3100

Getting Started

New Features in FDM/FTD Version 7.1.0

DescriptionFeature

FTDv for AWS adds support for these instances:

• c5a.xlarge, c5a.2xlarge, c5a.4xlarge

• c5ad.xlarge, c5ad.2xlarge, c5ad.4xlarge

• c5d.xlarge, c5d.2xlarge, c5d.4xlarge

• c5n.xlarge, c5n.2xlarge, c5n.4xlarge

• i3en.xlarge, i3en.2xlarge, i3en.3xlarge

• inf1.xlarge, inf1.2xlarge

• m5.xlarge, m5.2xlarge, m5.4xlarge

• m5a.xlarge, m5a.2xlarge, m5a.4xlarge

• m5ad.xlarge, m5ad.2xlarge, m5ad.4xlarge

• m5d.xlarge, m5d.2xlarge, m5d.4xlarge

• m5dn.xlarge, m5dn.2xlarge, m5dn.4xlarge

• m5n.xlarge, m5n.2xlarge, m5n.4xlarge

• m5zn.xlarge, m5zn.2xlarge, m5zn.3xlarge

• r5.xlarge, r5.2xlarge, r5.4xlarge

• r5a.xlarge, r5a.2xlarge, r5a.4xlarge

• r5ad.xlarge, r5ad.2xlarge, r5ad.4xlarge

• r5b.xlarge, r5b.2xlarge, r5b.4xlarge

• r5d.xlarge, r5d.2xlarge, r5d.4xlarge

• r5dn.xlarge, r5dn.2xlarge, r5dn.4xlarge

• r5n.xlarge, r5n.2xlarge, r5n.4xlarge

• z1d.xlarge, z1d.2xlarge, z1d.3xlarge

FTDv for AWS instances.

FTDv for Azure adds support for these instances:

• Standard_D8s_v3

• Standard_D16s_v3

• Standard_F8s_v2

• Standard_F16s_v2

FTDv for Azure instances.

You cannot install Firepower Threat DefenseFirepower Threat Defense

7.1 on an ASA 5508-X or 5516-X. The last supported release for these

models is Firepower Threat Defense 7.0.

Support ends for the ASA 5508-X

and 5516-X. The last supported

release is Firepower Threat Defense

7.0.

Getting Started

New Features in FDM/FTD Version 7.1.0

DescriptionFeature

Firewall and IPS Features

You can use FDM to configure the Network Analysis Policy (NAP)

when running Snort 3. Network analysis policies control traffic

preprocessing inspection. Inspectors prepare traffic to be further

inspected by normalizing traffic and identifying protocol anomalies.

You can select which NAP is used for all traffic, and customize the

settings to work best with the traffic in your network. You cannot

configure the NAP when running Snort 2.

We added the Network Analysis Policy to the Policies >Intrusion

settings dialog box, with an embedded JSON editor to allow direct

changes, and other features to let you upload overrides, or download

the ones you create.

Network Analysis Policy (NAP)

configuration for Snort 3.

You can use an FQDN network object, such as one specifying

www.example.com, as the translated destination address in manual NAT

rules. The system configures the rule based on the IP address returned

from the DNS server.

Manual NAT support for

fully-qualified domain name

(FQDN) objects as the translated

destination.

You can configure active authentication for identity policy rules to

redirect the user’s authentication to a fully-qualified domain name

(FQDN) rather than the IP address of the interface through which the

user’s connection enters the device. The FQDN must resolve to the IP

address of one of the interfaces on the device. By using an FQDN, you

can assign a certificate for active authentication that the client will

recognize, thus avoiding the untrusted certificate warning users get when

being redirected to an IP address. The certificate can specify the FQDN,

a wildcard FQDN, or multiple FQDNs in the Subject Alternate Names

(SAN) in the certificate.

We added the Redirect to Host Name option in the identity policy

settings.

Improved active authentication for

identity rules.

VPN Features

You can configure a site-to-site VPN connection to include remote

backup peers. If the primary remote peer is unavailable, the system will

try to re-establish the VPN connection using one of the backup peers.

You can configure separate pre-shared keys or certificates for each

backup peer. Backup peers are supported for policy-based connections

only, and are not available for route-based (virtual tunnel interface)

connections.

We updated the site-to-site VPN wizard to include backup peer

configuration.

Backup remote peers for site-to-site

VPN.

Getting Started

New Features in FDM/FTD Version 7.1.0

DescriptionFeature

You can enable password management for remote access VPN. This

allows AnyConnect to prompt the user to change an expired password.

Without password management, users must change expired passwords

directly with the AAA server, and AnyConnect does not prompt the user

to change passwords. For LDAP servers, you can also set a warning

period to notify users of upcoming password expiration.

We added the Enable Password Management option to the authentication

settings for remote access VPN connection profiles.

Password management for remote

access VPN (MSCHAPv2).

When you use SAML as the primary authentication method for a remote

access VPN connection profile, you can elect to have the AnyConnect

client use the client’s local browser instead of the AnyConnect embedded

browser to perform the web authentication. This option enables single

sign-on (SSO) between your VPN authentication and other corporate

logins. Also choose this option if you want to support web authentication

methods, such as biometric authentication, that cannot be performed in

the embedded browser.

We updated the remote access VPN connection profile wizard to allow

you to configure the SAML Login Experience.

AnyConnect VPN SAML External

Browser

Administrative and Troubleshooting Features

You can configure DDNS for the interfaces on the system to send

dynamic updates to DNS servers. This helps ensure that FQDNs defined

for the interfaces resolve to the correct address, making it easier for

users to access the system using a hostname rather than an IP address.

This is especially useful for interfaces that get their addresses using

DHCP, but it is also useful for statically-addressed interfaces.

After upgrade, if you had used FlexConfig to configure DDNS, you

must redo your configuration using FDM or the Firepower Threat

Defense API, and remove the DDNS FlexConfig object from the

FlexConfig policy, before you can deploy changes again.

If you configure DDNS using FDM, then switch to FMC management,

the DDNS configuration is retained so that FMC can find the system

using the DNS name.

In FDM, we added the System Settings >DDNS Service page. In the

Firepower Threat Defense API, we added the DDNSService and

DDNSInterfaceSettings resources.

Dynamic Domain Name System

(DDNS) support for updating

fully-qualified domain name

(FQDN) to IP address mappings for

system interfaces.

To look up the IP address of a fully-qualified domain name (FQDN) in

the device CLI, use the digcommand. The nslookup command has been

removed.

The dig command replaces the

nslookup command in the device

CLI.

Getting Started

New Features in FDM/FTD Version 7.1.0

DescriptionFeature

You can use FDM to configure DHCP relay. Using DHCP relay on an

interface, you can direct DHCP requests to a DHCP server that is

accessible through the other interface. You can configure DHCP relay

on physical interfaces, subinterfaces, EtherChannels, and VLAN

interfaces. You cannot configure DHCP relay if you configure a DHCP

server on any interface.

We added the System Settings >DHCP >DHCP Relay page, and

moved DHCP Server under the new DHCP heading.

DHCP relay configuration using

FDM.

You can specify the key type and size when generating new self-signed

internal and internal CA certificates in FDM. Key types include RSA,

ECDSA, and EDDSA. The allowed sizes differ by key type. We now

warn you if you upload a certificate whose key size is smaller than the

minimum recommended length. There is also a weak key pre-defined

search filter to help you find weak certificates, which you should replace

if possible.

Key type and size for self-signed

certificates in FDM.

You can specify whether a trusted CA certificate can be used to validate

certain types of connections. You can allow, or prevent, validation for

SSL server (used by dynamic DNS), SSL client (used by remote access

VPN), IPsec client (used by site-to-site VPN), or other features that are

not managed by the Snort inspection engine, such as LDAPS. The

primary purpose of these options is to let you prevent VPN connections

from getting established because they can be validated against a

particular certificate.

We added Validation Usage as a property for trusted CA certificates.

Usage validation restrictions for

trusted CA certificates.

During initial system configuration in FDM, or when you change the

admin password through FDM, you can now click a button to generate

a random 16 character password.

Generating the admin password in

FDM.

The show version command now includes information on how long it

took to start (boot) up the system. Note that the larger the configuration,

the longer it takes to boot up the system.

The new show asp rule-engine command shows status on tmatch

compilation. Tmatch compilation is used for an access list that is used

as an access group, the NAT table, and some other items. It is an internal

process that can consume CPU resources and impact performance while

in progress, if you have very large ACLs and NAT tables. Compilation

time depends on the size of the access list, NAT table, and so forth.

Startup time and tmatch

compilation status.

The output of the show access-list element-count command has been

enhanced. When used with object-group search enabled, the output

includes details about the number of object groups in the element count.

In addition, the show tech-support output now includes the output from

show access-list element-count and show asp rule-engine.

Enhancements to show access-list

element-count output.

Getting Started

New Features in FDM/FTD Version 7.1.0

DescriptionFeature

When you perform initial setup using FDM, all interface configuration

completed in FDM is retained when you switch to FMC for management,

in addition to the Management and FMC access settings. Note that other

default configuration settings, such as the access control policy or

security zones, are not retained. When you use the Firepower Threat

Defense CLI, only the Management and FMC access settings are retained

(for example, the default inside interface configuration is not retained).

After you switch to FMC, you can no longer use FDM to manage the

Firepower Threat Defense.

New/Modified screens: System Settings >Management Center

Use FDM to configure the

Firepower Threat Defense for

management by a FMC.

The local CA bundle contains certificates to access several Cisco

services. The system now automatically queries Cisco for new CA

certificates at a daily system-defined time. Previously, you had to

upgrade the software to update CA certificates. You can use the CLI to

disable this feature.

This feature is not supported in Version 7.0.0–7.0.4,

7.1.0–7.1.0.2, or 7.2.0–7.2.3. If you upgrade from a

supported version to an unsupported version, the feature

is temporarily disabled and the system stops contacting

Cisco.

Note

New/modified CLI commands: configure cert-update auto-update,

configure cert-update run-now,configure cert-update test,show

cert-update

For more information, see the Cisco Secure Firewall Threat Defense

Command Reference.

Automatically update CA bundles

The Firepower Threat Defense REST API for software version 7.1 is

version 6.2. You can use v6 in the API URLs, or preferentially, use

/latest/ to signify you are using the most recent API version that is

supported on the device. Note that the URL version path element for

6.2 is the same as 6.0/1: v6.

Please re-evaluate all existing calls, as changes might have been mode

to the resource models you are using. To open the API Explorer, where

you can view the resources, log into FDM, then click the more options

button ( ) and choose API Explorer.

FTD REST API version 6.2 (v6).

Logging Into the System

There are two interfaces to the Firepower Threat Defense device:

FDM Web Interface

The FDM runs in your web browser. You use this interface to configure, manage, and monitor the system.

Getting Started

Logging Into the System

Command Line Interface (CLI, Console)

Use the CLI for troubleshooting. You can also use it for initial setup instead of the FDM.

The following topics explain how to log into these interfaces and manage your user account.

Your User Role Controls What You Can See and Do

Your username is assigned a role, and your role determines what you can do or what you can see in the FDM.

The locally-defined admin user has all privileges, but if you log in using a different account, you might have

fewer privileges.

The upper-right corner of the FDM window shows your username and privilege level.

The privileges are:

•Administrator—You can see and use all features.

•Read-Write User—You can do everything a read-only user can do, and you can also edit and deploy

the configuration. The only restrictions are for system-critical actions, which include installing upgrades,

creating and restoring backups, viewing the audit log, and ending the sessions of other FDM users.

•Read-Only User—You can view dashboards and the configuration, but you cannot make any changes.

If you try to make a change, the error message explains that this is due to lack of permission.

These privileges are not related to those available for CLI users.

Logging Into the FDM

Use the FDM to configure, manage, and monitor the system. The features that you can configure through the

browser are not configurable through the command-line interface (CLI); you must use the web interface to

implement your security policies.

Use a current version of the following browsers: Firefox, Chrome, Safari, Edge.

If you type in the wrong password and fail to log in on 3 consecutive attempts, your account is locked for 5

minutes. You must wait before trying to log in again.

Note

Before you begin

Initially, you can log into the FDM using the admin username only. However, you can then configure

authorization for additional users defined in an external AAA server, as described in Managing FDM and

FTD User Access.

There can be up to 5 active logins at one time. This includes users logged into the device manager and active

API sessions, which are represented by non-expired API tokens. If you exceed this limit, the oldest session,

either the device manager login or API token, is expired to allow the new session. These limits do not apply

to SSH sessions.

Getting Started

Your User Role Controls What You Can See and Do

Procedure

Step 1 Using a browser, open the home page of the system, for example, https://ftd.example.com.

You can use any of the following addresses. You can use the IPv4 or IPv6 address or the DNS name, if you

have configured one.

• The management address. By default (on most platforms), the Management interface is a DHCP client,

so the IP address depends on your DHCP server.

• The address of a data interface that you have opened for HTTPS access. By default (on most platforms),

the “inside” interface allows HTTPS access, so you can connect to the default inside address 192.168.95.1.

See Default Configuration Prior to Initial Setup, on page 26 for details about your model's inside IP

address.

If you changed the HTTPS data port, you must include the custom port in the URL. For example, if you

changed the port to 4443: https://ftd.example.com:4443

If your browser is not configured to recognize the server certificate, you will see a warning about

an untrusted certificate. Accept the certificate as an exception, or in your trusted root certificate

store.

Tip

Step 2 Enter your username and password defined for the device, then click Login.

You can use the admin username, which is a pre-defined user. The default admin password is Admin123. On

AWS, the default admin password is the AWS Instance ID, unless you define a default password with user

data (Advanced Details >User Data) during the initial deployment.

Your session will expire after 30 minutes of inactivity, and you will be prompted to log in again. You can log

out by selecting Log Out from the user icon drop-down menu in the upper right of the page.

Logging Into the Command Line Interface (CLI)

Use the command-line interface (CLI) to set up the system and do basic system troubleshooting. You cannot

configure policies through a CLI session.

To log into the CLI, do one of the following:

•Use the console cable included with the device to connect your PC to the console using a terminal emulator

set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control. See the hardware guide for your

device for more information about the console cable.

Getting Started

Logging Into the Command Line Interface (CLI)

On the Firepower and Secure Firewall device models, the CLI on the Console

port is the Firepower eXtensible Operating System (FXOS). For the Firepower

1000/2100, you can get to the Firepower Threat Defense CLI using the connect

ftd command. For the Firepower 4100/9300, see Connect to the Console of the

Application. Use the FXOS CLI for chassis-level troubleshooting only. Use the

Firepower Threat Defense CLI for basic configuration, monitoring, and normal

system troubleshooting. See the FXOS documentation for information on FXOS

commands.

Note

• For the FTDv, open the virtual console.

• Use an SSH client to make a connection to the management IP address. You can also connect to the

address on a data interface if you open the interface for SSH connections (see Configuring the Management

Access List). SSH access to data interfaces is disabled by default. Log in using the admin username or

another CLI user account. The default admin password is Admin123. On AWS, the default admin

password for the FTDv is the AWS Instance ID, unless you define a default password with user data

(Advanced Details >User Data) during the initial deployment.

Tips

• After logging in, for information on the commands available in the CLI, enter help or ?. For usage

information, see Cisco Firepower Threat Defense Command Reference at http://www.cisco.com/c/en/

us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense.html.

• You can create local user accounts that can log into the CLI using the configure user add command.

However, these users can log into the CLI only. They cannot log into the FDM web interface.

• You can create user accounts for SSH access in an external server. For information about configuring

external authentication for SSH access, see Configuring External Authorization (AAA) for the FTD CLI

(SSH) Users.

Changing Your Password

You should periodically change your password. The following procedure explains how to change the password

while logged into FDM.

If you are logged into the CLI, you can change your password using the configure password command. You

can change the password for a different CLI user with the configure user password username command.

Note

Before you begin

This procedure applies to local users only. If your user account is defined on an external AAA server, you

must change your password with that server.

Getting Started

Changing Your Password

Otros manuales para Firepower 1010

Este manual sirve para los siguientes modelos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco ASA Guía de inicio rápido

Cisco

Cisco ISA550 Manual de instrucciones

Cisco

Cisco NCS 4016 Manual de usuario

Cisco

Cisco TelePresence Manual de servicio

Cisco

Cisco ONS 15454 DWDM Manual de usuario

Cisco

Cisco VPN 3002 Hardware Client Manager Manual de usuario

Cisco

Cisco Aironet 1400 Series Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco Cisco ONS 15600 SDH Manual de usuario

Cisco

Cisco PIX Series Manual

Cisco

Cisco IPS 7.1 Manual de usuario

Cisco

Cisco CTM GateWay Guía de instalación

Cisco

Cisco 3600 Series Instrucciones de funcionamiento y seguridad

Cisco

Cisco AIM-VPN - DES/3DES VPN Data Encryption AIM... Manual de usuario

Cisco

Cisco ISA500 Series Manual de instrucciones

Cisco

Cisco ONS 15454 M12 Manual de usuario

Cisco

Cisco IronPort C670 Manual de usuario

Cisco

Cisco Prisma EtherLinX Manual de usuario

Cisco

Cisco SCE8000 GBE Manual de usuario

Cisco

Cisco IPS-4240-K9 - Intrusion Protection Sys 4240 Manual de usuario

Cisco

Cisco NCS 2002 Manual de instrucciones

Cisco

Cisco Octal-Port DMT ATU-C Line Card Manual técnico

Cisco

Cisco VSVM Manual de instrucciones

Cisco

Cisco LightStream 1010 Manual

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario